Skip to content

fix(installer): restore Station package preparation #7183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericksoa merged 2 commits into from
Jul 19, 2026
Merged

fix(installer): restore Station package preparation #7183

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
74b2849
fix(installer): restore Station package preparation
senthilr-nv Jul 19, 2026
4ea0f4b
test(installer): enforce package quiescence order
ericksoa Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions scripts/prepare-dgx-station-host.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1436,7 +1436,7 @@ create_apt_transaction_guard() {
assert_root_directory_safe "$APT_TRANSACTION_GUARD_DIR" "APT transaction guard directory"
assert_root_regular_file_safe "$hook_path" 0700 "APT transaction guard"
assert_root_regular_file_safe "$targets_path" 0600 "APT transaction target manifest"
APT_TRANSACTION_HOOK=$hook_path
APT_TRANSACTION_HOOK="/bin/bash ${hook_path}"
}

validate_apt_simulation() {
Expand Down Expand Up @@ -1496,12 +1496,13 @@ validate_apt_simulation() {

simulate_install() {
local simulation
[[ "$APT_TRANSACTION_HOOK" =~ ^/run/nemoclaw-apt-transaction\.[A-Za-z0-9]+/verify-plan$ ]] \
[[ "$APT_TRANSACTION_GUARD_DIR" =~ ^/run/nemoclaw-apt-transaction\.[A-Za-z0-9]+$ &&
"$APT_TRANSACTION_HOOK" == "/bin/bash ${APT_TRANSACTION_GUARD_DIR}/verify-plan" ]] \
|| fatal "APT transaction guard is not ready"
simulation="$(sudo env DEBIAN_FRONTEND=noninteractive LC_ALL=C \
apt-get -s install --no-install-recommends --no-remove \
-o "DPkg::Pre-Install-Pkgs::=${APT_TRANSACTION_HOOK}" \
-o "DPkg::Tools::options::${APT_TRANSACTION_HOOK}::Version=3" "$@")" \
-o "DPkg::Tools::options::/bin/bash::Version=3" "$@")" \
|| fatal "APT simulation failed"
printf '%s\n' "$simulation"
validate_apt_simulation "$simulation" "$@"
Expand All @@ -1516,13 +1517,12 @@ install_packages() {
validate_package_availability "${PACKAGE_TRANSACTION_SPECS[@]}"
create_apt_transaction_guard
simulate_install "${PACKAGE_TRANSACTION_SPECS[@]}"
check_no_workloads
require_docker_restart_quiescence "Station prerequisite package installation"
info "Installing missing pinned Station prerequisites"
sudo env DEBIAN_FRONTEND=noninteractive LC_ALL=C \
apt-get install -y --no-install-recommends --no-remove \
-o "DPkg::Pre-Install-Pkgs::=${APT_TRANSACTION_HOOK}" \
-o "DPkg::Tools::options::${APT_TRANSACTION_HOOK}::Version=3" \
-o "DPkg::Tools::options::/bin/bash::Version=3" \
"${PACKAGE_TRANSACTION_SPECS[@]}"
cleanup_apt_transaction_guard

Expand Down
3 changes: 1 addition & 2 deletions test/install-station-host-preparation.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -416,13 +416,12 @@ run_apply
configure_repositories() { printf 'CONFIGURE_REPOSITORIES\n'; }
validate_package_availability() { printf 'VALIDATE_PACKAGES\n'; }
simulate_install() { printf 'SIMULATE_INSTALL\n'; }
check_no_workloads() { printf 'RECHECK_ALL_WORKLOADS\n'; }
require_docker_restart_quiescence() { printf 'RECHECK_RESTART_QUIESCENCE\n'; }
package_state() { printf 'missing\n'; }
package_is_exact() { return 0; }
create_apt_transaction_guard() {
APT_TRANSACTION_GUARD_DIR=/run/nemoclaw-apt-transaction.TEST
APT_TRANSACTION_HOOK="$APT_TRANSACTION_GUARD_DIR/verify-plan"
APT_TRANSACTION_HOOK="/bin/bash $APT_TRANSACTION_GUARD_DIR/verify-plan"
}
cleanup_apt_transaction_guard() { :; }
sudo() { printf 'SUDO %s\n' "$*"; }
Expand Down
37 changes: 23 additions & 14 deletions test/install-station-package-transaction.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,13 +89,12 @@ apt-get() {
done
fi
}
check_no_workloads() { printf 'RECHECK_ALL_WORKLOADS\n'; }
require_docker_restart_quiescence() { printf 'RECHECK_DOCKER_RESTART\n'; }
package_state() { printf 'missing\n'; }
package_is_exact() { return 0; }
create_apt_transaction_guard() {
APT_TRANSACTION_GUARD_DIR=/run/nemoclaw-apt-transaction.TEST
APT_TRANSACTION_HOOK="$APT_TRANSACTION_GUARD_DIR/verify-plan"
APT_TRANSACTION_HOOK="/bin/bash $APT_TRANSACTION_GUARD_DIR/verify-plan"
}
cleanup_apt_transaction_guard() {
printf 'CLEANUP_GUARD\n'
Expand Down Expand Up @@ -124,14 +123,14 @@ cat "$HOME/apt-cache-calls"
expect(aptCommands).toEqual(
[
...EXPECTED_PACKAGE_SPECS.map((spec) => `APT_CACHE show ${spec}`),
`APT_GET -s install --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/run/nemoclaw-apt-transaction.TEST/verify-plan::Version=3 ${expectedTuple}`,
`SUDO env DEBIAN_FRONTEND=noninteractive LC_ALL=C apt-get install -y --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/run/nemoclaw-apt-transaction.TEST/verify-plan::Version=3 ${expectedTuple}`,
`APT_GET -s install --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/bin/bash /run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/bin/bash::Version=3 ${expectedTuple}`,
`SUDO env DEBIAN_FRONTEND=noninteractive LC_ALL=C apt-get install -y --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/bin/bash /run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/bin/bash::Version=3 ${expectedTuple}`,
].sort(),
);
expect(output).toContain(
"SUDO env DEBIAN_FRONTEND=noninteractive LC_ALL=C apt-get -s install --no-install-recommends --no-remove",
);
expect(output).toContain("RECHECK_ALL_WORKLOADS");
expect(output).toContain("RECHECK_DOCKER_RESTART");
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
expect(output).toContain("CLEANUP_GUARD");
expect(output).toContain("pinned_packages=installed");
});
Expand All @@ -155,15 +154,14 @@ apt-get() {
done
fi
}
check_no_workloads() { :; }
require_docker_restart_quiescence() { :; }
package_state() {
if [[ "$1" == '${retainedSpec}' ]]; then printf 'exact\n'; else printf 'missing\n'; fi
}
package_is_exact() { return 0; }
create_apt_transaction_guard() {
APT_TRANSACTION_GUARD_DIR=/run/nemoclaw-apt-transaction.TEST
APT_TRANSACTION_HOOK="$APT_TRANSACTION_GUARD_DIR/verify-plan"
APT_TRANSACTION_HOOK="/bin/bash $APT_TRANSACTION_GUARD_DIR/verify-plan"
}
cleanup_apt_transaction_guard() {
APT_TRANSACTION_GUARD_DIR=""
Expand Down Expand Up @@ -191,8 +189,8 @@ cat "$HOME/apt-cache-calls"
expect(aptCommands).toEqual(
[
...missingSpecs.map((spec) => `APT_CACHE show ${spec}`),
`APT_GET -s install --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/run/nemoclaw-apt-transaction.TEST/verify-plan::Version=3 ${expectedTuple}`,
`SUDO env DEBIAN_FRONTEND=noninteractive LC_ALL=C apt-get install -y --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/run/nemoclaw-apt-transaction.TEST/verify-plan::Version=3 ${expectedTuple}`,
`APT_GET -s install --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/bin/bash /run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/bin/bash::Version=3 ${expectedTuple}`,
`SUDO env DEBIAN_FRONTEND=noninteractive LC_ALL=C apt-get install -y --no-install-recommends --no-remove -o DPkg::Pre-Install-Pkgs::=/bin/bash /run/nemoclaw-apt-transaction.TEST/verify-plan -o DPkg::Tools::options::/bin/bash::Version=3 ${expectedTuple}`,
].sort(),
);
expect(aptCommands.join("\n")).not.toContain(retainedSpec);
Expand All @@ -216,7 +214,7 @@ installed_version() { if [[ "$1" == "libc6" ]]; then printf '2.39-0ubuntu8'; fi;
package_is_exact() { return 0; }
create_apt_transaction_guard() {
APT_TRANSACTION_GUARD_DIR=/run/nemoclaw-apt-transaction.TEST
APT_TRANSACTION_HOOK="$APT_TRANSACTION_GUARD_DIR/verify-plan"
APT_TRANSACTION_HOOK="/bin/bash $APT_TRANSACTION_GUARD_DIR/verify-plan"
}
sudo() {
printf 'SUDO %s\n' "$*"
Expand Down Expand Up @@ -358,7 +356,7 @@ install_packages
}
});

it("emits an executable root-hook payload bound to its target manifest", () => {
it("emits a noexec-safe root-hook command bound to its target manifest", () => {
const { result, output } = runSourced(
`
PACKAGE_TRANSACTION_SPECS=('${DOCKER_CE_SPEC}')
Expand All @@ -378,12 +376,18 @@ sudo() {
cat >"$HOME/generated-guard/\${2##*/}"
;;
chmod)
command chmod "$2" "$HOME/generated-guard/\${3##*/}"
printf 'SUDO %s\n' "$*"
if [[ "$3" == /run/nemoclaw-apt-transaction.GENERATED ]]; then
command chmod "$2" "$HOME/generated-guard"
else
command chmod "$2" "$HOME/generated-guard/\${3##*/}"
fi
;;
esac
}
create_apt_transaction_guard
"$HOME/generated-guard/verify-plan" <<<"$APT_PLAN"
/bin/bash "$HOME/generated-guard/verify-plan" <<<"$APT_PLAN"
printf 'APT_HOOK=%s\n' "$APT_TRANSACTION_HOOK"
printf 'GENERATED_HOOK_ACCEPTED\n'
`,
{
Expand All @@ -396,6 +400,11 @@ printf 'GENERATED_HOOK_ACCEPTED\n'

expect(result.status, output).toBe(0);
expect(output).toContain("GENERATED_HOOK_ACCEPTED");
expect(output).toContain(
"APT_HOOK=/bin/bash /run/nemoclaw-apt-transaction.GENERATED/verify-plan",
);
expect(output).toContain("SUDO chmod 0700 /run/nemoclaw-apt-transaction.GENERATED/verify-plan");
expect(output).toContain("SUDO chmod 0600 /run/nemoclaw-apt-transaction.GENERATED/targets");
});

it("cleans the root-owned transaction guard when the caller exits", () => {
Expand All @@ -404,7 +413,7 @@ sudo() { printf 'SUDO %s\n' "$*"; }
setup_log() { :; }
run_apply() {
APT_TRANSACTION_GUARD_DIR=/run/nemoclaw-apt-transaction.EXITTEST
APT_TRANSACTION_HOOK="$APT_TRANSACTION_GUARD_DIR/verify-plan"
APT_TRANSACTION_HOOK="/bin/bash $APT_TRANSACTION_GUARD_DIR/verify-plan"
}
main --apply
`);
Expand Down
Loading